Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/12/2022, 22:16

General

  • Target

    5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe

  • Size

    746KB

  • MD5

    1c1aa12967b3ed3043ad16c1f8d6b54f

  • SHA1

    dba7f6324ef35a521e136230a5f2b9686c7b2150

  • SHA256

    5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de

  • SHA512

    23e321cccdc1fd8fbb8f3e331e865bfc8f5270ffdadc8b7062e7a1aa8e05c0dba5f95682be3413e5325d70c0f6fab3bb61452695f920dc67fdacacbb2d5fc2e8

  • SSDEEP

    12288:fbnxitpeOnShgCytH1SL1esWb/Ln+zpCL8037tXTLk8qKPqJWNVH/8:9iv341yp141eD/+zwL8aTXvqJWbH/

Malware Config

Extracted

Family

djvu

C2

http://abibiall.com/test1/get.php

Attributes
  • extension

    .isal

  • offline_id

    m3KmScxfDyEQzJYP8qjOSfP4FvpsOXlekGuMPzt1

  • payload_url

    http://uaery.top/dl/build2.exe

    http://abibiall.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-Q5EougBEbU Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0620IsgU

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 10 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe
    "C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe
      "C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\f38f7e71-52c1-40e7-bb6a-e860f6cf1723" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:1756
      • C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe
        "C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2660
        • C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe
          "C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1644
          • C:\Users\Admin\AppData\Local\2f1b2ace-3eb2-4793-ac95-8f2c14b53f5e\build2.exe
            "C:\Users\Admin\AppData\Local\2f1b2ace-3eb2-4793-ac95-8f2c14b53f5e\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3844
            • C:\Users\Admin\AppData\Local\2f1b2ace-3eb2-4793-ac95-8f2c14b53f5e\build2.exe
              "C:\Users\Admin\AppData\Local\2f1b2ace-3eb2-4793-ac95-8f2c14b53f5e\build2.exe"
              6⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Loads dropped DLL
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4032
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\2f1b2ace-3eb2-4793-ac95-8f2c14b53f5e\build2.exe" & exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:2952
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 6
                  8⤵
                  • Delays execution with timeout.exe
                  PID:1100

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\mozglue.dll

    Filesize

    133KB

    MD5

    8f73c08a9660691143661bf7332c3c27

    SHA1

    37fa65dd737c50fda710fdbde89e51374d0c204a

    SHA256

    3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

    SHA512

    0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

  • C:\ProgramData\nss3.dll

    Filesize

    1.2MB

    MD5

    bfac4e3c5908856ba17d41edcd455a51

    SHA1

    8eec7e888767aa9e4cca8ff246eb2aacb9170428

    SHA256

    e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

    SHA512

    2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    2KB

    MD5

    d725336098482e86274e5930393506a1

    SHA1

    7cb24085418693dc0c0fc876b6f7d2d400a7c256

    SHA256

    a2550a47e8dee78c170ecdfc8918137469b6115cf32fedc091b80c7dea2701a1

    SHA512

    f67ff810c97f14f9704439a7a3d34588b013eedc97149298c833926bc92d12b1e76b68c684863f86f8dede7fc677139f6c8af8e83bd43cad965ed32bda15ed3f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    1KB

    MD5

    bae107243c3c1cc23eb066f981b79948

    SHA1

    ed066a4326ae4eb5db4b00b0bb0290f006ad456c

    SHA256

    7d2ba9f4e363368512dc2388d792c3f971d18699234c4edab57ddd4053870026

    SHA512

    67a0ba993ab7abab0973683f134d71ed96cbff33368b222fc84e57def50c57d1c6d1c64362738baa9efa8cd84a3ccee30cc67284b2cd8ea53cbb8d1bfed94764

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    488B

    MD5

    7b65cf785cbc8431e6fc6e915c96400b

    SHA1

    bbe76eb330d01043ff6e40c00b725a32de65629a

    SHA256

    bfeab37b1ca70573067d910961dc6ff1b93c3b049547ae54b9ec740704f550ce

    SHA512

    8e61d2a60d51a4c5d5c88e4a0b71722e285675672608ee6fc46f789e2fa33f91ac64211e2b20b06fb0f0a7d378c4d0bf6daa4e97b462ede3adff2353fa995549

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    482B

    MD5

    d6b10ee4adfbf335b1e59f1d3d6442b0

    SHA1

    46b5f588b7382bff0aaccda00e3c3eb02a490147

    SHA256

    25ae173699da11e9ef0f78ee5427c77796d4d2eec41cc8d91e7dde13b7f3c266

    SHA512

    e8a25fc1a34ae24b2afac0343826453ee3c25a861ff58299d6caa6c09f965b60fc270c004ef651134880e4b90c67902bc71e00f798b4815578b68a20df66efa1

  • C:\Users\Admin\AppData\Local\2f1b2ace-3eb2-4793-ac95-8f2c14b53f5e\build2.exe

    Filesize

    409KB

    MD5

    a131064868de7468d2e768211431401b

    SHA1

    381ad582f72b30b4764afe0a817569b384be65a2

    SHA256

    027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1

    SHA512

    40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309

  • C:\Users\Admin\AppData\Local\2f1b2ace-3eb2-4793-ac95-8f2c14b53f5e\build2.exe

    Filesize

    409KB

    MD5

    a131064868de7468d2e768211431401b

    SHA1

    381ad582f72b30b4764afe0a817569b384be65a2

    SHA256

    027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1

    SHA512

    40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309

  • C:\Users\Admin\AppData\Local\2f1b2ace-3eb2-4793-ac95-8f2c14b53f5e\build2.exe

    Filesize

    409KB

    MD5

    a131064868de7468d2e768211431401b

    SHA1

    381ad582f72b30b4764afe0a817569b384be65a2

    SHA256

    027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1

    SHA512

    40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309

  • C:\Users\Admin\AppData\Local\f38f7e71-52c1-40e7-bb6a-e860f6cf1723\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe

    Filesize

    746KB

    MD5

    1c1aa12967b3ed3043ad16c1f8d6b54f

    SHA1

    dba7f6324ef35a521e136230a5f2b9686c7b2150

    SHA256

    5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de

    SHA512

    23e321cccdc1fd8fbb8f3e331e865bfc8f5270ffdadc8b7062e7a1aa8e05c0dba5f95682be3413e5325d70c0f6fab3bb61452695f920dc67fdacacbb2d5fc2e8

  • memory/1644-152-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1644-145-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1644-147-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1644-164-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2660-146-0x00000000004F7000-0x0000000000588000-memory.dmp

    Filesize

    580KB

  • memory/2744-142-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2744-133-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2744-134-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2744-135-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2744-137-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/3844-161-0x00000000020B0000-0x0000000002103000-memory.dmp

    Filesize

    332KB

  • memory/3844-159-0x00000000006E8000-0x0000000000716000-memory.dmp

    Filesize

    184KB

  • memory/4032-162-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/4032-160-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/4032-163-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/4032-165-0x0000000060900000-0x0000000060992000-memory.dmp

    Filesize

    584KB

  • memory/4032-157-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/4032-187-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/4160-136-0x0000000000721000-0x00000000007B2000-memory.dmp

    Filesize

    580KB

  • memory/4160-138-0x00000000021A0000-0x00000000022BB000-memory.dmp

    Filesize

    1.1MB